fix(env): use safe tar extract on env pull - #789
Conversation
Align prime env pull with private install by rejecting path traversal, absolute paths, and links via _safe_tar_extract.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 84b3114222
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
tar.add can emit LNKTYPE for shared inodes, which _safe_tar_extract rejects on pull. Write REGTYPE content instead so push/pull stay compatible.
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
1 participant
Summary
_safe_tar_extractinprime env pull(same path used by private install / Lab cache).., absolute paths, symlinks, or hardlinks before writing filesTest plan
uv run pytest packages/prime/tests/test_env_pull_path.py packages/prime/tests/test_private_env_install.py -qNote
Medium Risk
Changes untrusted archive extraction and push tarball format; security-hardening with aligned tests, but any bug could break pull/push or block legitimate archives.
Overview
Hardens environment package handling so downloaded archives cannot write outside the target directory and pushed source tarballs stay compatible with the same safe extractor used on install.
prime env pullnow calls_safe_tar_extractinstead of rawextractall, matching private install / Lab cache behavior: members with.., absolute paths, symlinks, or hardlinks are rejected before anything is written.ValueErrorfrom that check is surfaced as a failed extract with exit code 1.On
prime env push, source archives no longer usetar.add()for collected files. New_add_file_to_archivealways stores regular file bytes (REGTYPE), becausetar.add()can emit hardlink members that_safe_tar_extractwould refuse on pull. Collect-time behavior for symlinks is unchanged (still skipped); hardlinked workspace files are still included, just not asLNKTYPEin the tarball.Regression tests cover pull rejection of traversal/symlink archives, successful safe extraction, and push archives that remain extractable after hardlinks on disk.
Reviewed by Cursor Bugbot for commit 6cfdff4. Bugbot is set up for automated code reviews on this repo. Configure here.